Qualify Claude defaults against pinned Daytona snapshot identities

Co-Authored-By: Paperclip <noreply@paperclip.ing>

maps/agent-access-map/execution-environments.md

@@ -95,7 +95,8 @@ Both probe endpoints require a board actor that is local-implicit or an instance
 administrator; ordinary agent identity and company membership alone are denied.
 The saved sandbox probe also resolves company/environment and secret access
 before allocating a fresh lease. Its measurement is company-bound to an immutable
-image digest, effective provider configuration and active custom-image identity;
+image digest or verified Daytona snapshot ID, effective provider configuration
+and active custom-image identity;
 only confirmed cleanup permits recording it. A draft probe does not record saved
 qualification. Reading stored qualification does not lease/provision a target and
 does not grant an agent permission to probe or manage that target.
@@ -117,7 +118,8 @@ at the scoped commit. A connection-only success or a fixture cannot certify
 native compatibility, account authentication or agent access.
 
 Scoped Verification: `not-run` — on one authorized owned target, compare pinned
-image proof with mutable/snapshot and changed-config controls; require independent
+image and provider snapshot-ID proof with mutable-image, unverified-snapshot
+and changed-config/account controls; require independent
 cleanup evidence before recording proof. Assert agent/non-admin board denial,
 secret-context denial where the actor lacks access and forged-proof rejection.
 Verify API reads hide the private record and metadata-only updates cannot overwrite it. Then use

maps/feature-map/execution-environments.md

@@ -42,8 +42,8 @@ Automated: [environment UI](../../ui/src/pages/CompanyEnvironments.test.tsx), [d
 
 Manual: Save a disposable target, reload it, and run its available probe. Verify both success and missing-credential/reachability errors identify the target. Confirm unavailable providers are not offered as working run targets.
 
-For an immutable sandbox image, pin the OCI image with `@sha256` and explicitly
-probe the saved environment in the intended company. The existing connection
+For an immutable sandbox image, pin the OCI image with `@sha256`, or select
+a Daytona snapshot whose provider ID can be verified, and explicitly probe the saved environment in the intended company. The existing connection
 probe allocates a fresh lease and can measure its OS, architecture and libc.
 Qualification is recorded only when the selected image/configuration matches
 the live lease and cleanup is confirmed. Inspect `platformQualificationRecorded`
@@ -52,7 +52,10 @@ the image has native runtime qualification.
 
 The measured record is server-owned, company-bound and tied to the effective
 configuration and active custom-image identity. Mutable tags, provider defaults
-and name-only snapshots do not qualify. Changing the target or image invalidates
+and snapshots without verified provider identities do not qualify. Daytona
+qualification creates by provider ID and binds native execution to that same ID;
+a deleted ID fails instead of resolving a replacement name. Changing the target,
+account, image or active captured template invalidates
 the record; normal metadata edits cannot forge or overwrite it, and API reads
 omit the private metadata. Reading this evidence for discovery or creation does
 not allocate a sandbox. The draft `probe-config` checks are not a saved-image

maps/feature-map/onboarding.md

@@ -68,14 +68,16 @@ Use [runner validation](./runs-adapters.md#adapter-setup) and
 [environment qualification](./execution-environments.md#environment-settings)
 for the prerequisites; a successful login alone is insufficient.
 
-For a new Claude agent on an explicit immutable sandbox image, use Connect to
+For a new Claude agent on an explicit immutable sandbox image or a Daytona
+named snapshot, use Connect to
 qualify the selected environment through the existing permission-gated probe.
 Do not preprobe outside onboarding when claiming this first-use path. Fresh
 scoped discovery determines the runner for both the account test and hire;
 the measured Legacy result remains valid. An instance-admin denial, incomplete
 cleanup, missing lease or changed configuration stops setup before the adapter
-test or hire. Named snapshots and mutable image tags do not gain qualification
-through this flow. [Helper controls](../../ui/src/lib/qualify-claude-setup.test.ts)
+test or hire. Daytona resolves the selected snapshot to its immutable provider
+ID before creating the measured lease; native execution pins that same ID.
+Mutable image tags and other providers’ named templates remain unqualified. [Helper controls](../../ui/src/lib/qualify-claude-setup.test.ts)
 and mounted wizard/new-agent tests use mocks; live managed acceptance remains a
 separate gate.
 For a new Codex agent with Auto on a saved immutable OCI sandbox, Connect first